From: Ankit Kumar (kuankit) <kuankit@cisco.com>
Date: Thu, 19 Feb 2026 05:08:32 +0000 (+0000)
Subject: Pull request #5145: ftp_telnet: Improve performance in TelnetSplitter
X-Git-Tag: 3.11.1.0~7
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=3abf02c531b4e433c66f1c080e2339be34c8cd7a;p=thirdparty%2Fsnort3.git

Pull request #5145: ftp_telnet: Improve performance in TelnetSplitter

Merge in SNORT/snort3 from ~KUANKIT/snort3:fix/telnet-splitter-perf-bug to master

Squashed commit of the following:

commit df42809385a8275932915c81c3c163ec22fec66b
Author: kuankit <kuankit@cisco.com>
Date:   Thu Feb 5 02:09:17 2026 -0800

    ftp_telnet: improve performance in TelnetSplitter
---

diff --git a/src/service_inspectors/ftp_telnet/telnet_splitter.cc b/src/service_inspectors/ftp_telnet/telnet_splitter.cc
index cced05757..b53932e7b 100644
--- a/src/service_inspectors/ftp_telnet/telnet_splitter.cc
+++ b/src/service_inspectors/ftp_telnet/telnet_splitter.cc
@@ -68,28 +68,34 @@ StreamSplitter::Status TelnetSplitter::scan(
         {
             case TELNET_NONE:
             {
-                const uint8_t* cr = static_cast<const uint8_t*>(memchr(read_ptr, '\r', end - read_ptr));
-                const uint8_t* lf = static_cast<const uint8_t*>(memchr(read_ptr, '\n', end - read_ptr));
-                const uint8_t* ptr = nullptr;
-                if ( cr && !lf )
-                    ptr = cr;
-                else if ( !cr && lf )
-                    ptr = lf;
-                else if ( cr && lf )
-                    ptr = ( cr > lf ) ? cr : lf;
-
-                const uint8_t* iac_ptr = static_cast<const uint8_t*>(memchr( read_ptr, TNC_IAC, end - read_ptr));
-                if ( (ptr && iac_ptr && ptr < iac_ptr) || (ptr && !iac_ptr) )
+                const uint8_t* ptr = nullptr;      // last CR or LF found
+                const uint8_t* iac_ptr = nullptr;  // first IAC found
+
+                for ( const uint8_t* scan = read_ptr; scan < end; ++scan )
                 {
-                    fp_ptr = ptr;
-                    read_ptr = fp_ptr;
+                    uint8_t c = *scan;
+                    if ( c == '\r' || c == '\n' )
+                        ptr = scan;
+
+                    else if ( c == TNC_IAC )
+                    {
+                        iac_ptr = scan;
+                        break;
+                    }
                 }
 
+                if ( (ptr && iac_ptr && ptr < iac_ptr) || (ptr && !iac_ptr) )
+                    fp_ptr = ptr;
+
                 if ( iac_ptr )
                 {
                     state = TELNET_IAC;
                     read_ptr = iac_ptr;
                 }
+                else if ( ptr )
+                    read_ptr = ptr;
+                else
+                    read_ptr = end;
                 break;
             }
             case TELNET_IAC: